There is a special tool required to remove this hijack. Get another fresh hijackthis log and copy and paste the text of it here (rather than image attaching it) here and we'll look at it. The files responsible morph so they probably won't be the same now. Ideally he needs to avoid using IE after creating the log. Downloading and using Mozilla's firefox to use in the meantime would help.

Regards
Scoff

We've heard that a million monkeys at a million keyboards could produce the complete works of Shakespeare; now, thanks to the Internet, we know that is not true. - Robert Wilensky